]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.9-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 7 Nov 2022 16:56:10 +0000 (17:56 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 7 Nov 2022 16:56:10 +0000 (17:56 +0100)
added patches:
alsa-usb-audio-add-quirks-for-macrosilicon-ms2100-ms2106-devices.patch
ext4-fix-warning-in-ext4_da_release_space.patch
kvm-x86-emulator-em_sysexit-should-update-ctxt-mode.patch
kvm-x86-emulator-introduce-emulator_recalc_and_set_mode.patch
kvm-x86-emulator-update-the-emulation-mode-after-cr0-write.patch
kvm-x86-mask-off-reserved-bits-in-cpuid.80000008h.patch
parisc-export-iosapic_serial_irq-symbol-for-serial-port-driver.patch
parisc-make-8250_gsc-driver-dependend-on-config_parisc.patch

queue-4.9/alsa-usb-audio-add-quirks-for-macrosilicon-ms2100-ms2106-devices.patch [new file with mode: 0644]
queue-4.9/ext4-fix-warning-in-ext4_da_release_space.patch [new file with mode: 0644]
queue-4.9/kvm-x86-emulator-em_sysexit-should-update-ctxt-mode.patch [new file with mode: 0644]
queue-4.9/kvm-x86-emulator-introduce-emulator_recalc_and_set_mode.patch [new file with mode: 0644]
queue-4.9/kvm-x86-emulator-update-the-emulation-mode-after-cr0-write.patch [new file with mode: 0644]
queue-4.9/kvm-x86-mask-off-reserved-bits-in-cpuid.80000008h.patch [new file with mode: 0644]
queue-4.9/parisc-export-iosapic_serial_irq-symbol-for-serial-port-driver.patch [new file with mode: 0644]
queue-4.9/parisc-make-8250_gsc-driver-dependend-on-config_parisc.patch [new file with mode: 0644]
queue-4.9/series

diff --git a/queue-4.9/alsa-usb-audio-add-quirks-for-macrosilicon-ms2100-ms2106-devices.patch b/queue-4.9/alsa-usb-audio-add-quirks-for-macrosilicon-ms2100-ms2106-devices.patch
new file mode 100644 (file)
index 0000000..570262b
--- /dev/null
@@ -0,0 +1,99 @@
+From 6e2c9105e0b743c92a157389d40f00b81bdd09fe Mon Sep 17 00:00:00 2001
+From: John Veness <john-linux@pelago.org.uk>
+Date: Fri, 24 Jun 2022 15:07:57 +0100
+Subject: ALSA: usb-audio: Add quirks for MacroSilicon MS2100/MS2106 devices
+
+From: John Veness <john-linux@pelago.org.uk>
+
+commit 6e2c9105e0b743c92a157389d40f00b81bdd09fe upstream.
+
+Treat the claimed 96kHz 1ch in the descriptors as 48kHz 2ch, so that
+the audio stream doesn't sound mono. Also fix initial stream
+alignment, so that left and right channels are in the correct order.
+
+Signed-off-by: John Veness <john-linux@pelago.org.uk>
+Link: https://lore.kernel.org/r/20220624140757.28758-1-john-linux@pelago.org.uk
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/quirks-table.h |   58 +++++++++++++++++++++++++++++++++++++++++++++++
+ sound/usb/quirks.c       |    1 
+ 2 files changed, 59 insertions(+)
+
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3334,6 +3334,64 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge
+ },
+ /*
++ * MacroSilicon MS2100/MS2106 based AV capture cards
++ *
++ * These claim 96kHz 1ch in the descriptors, but are actually 48kHz 2ch.
++ * They also need QUIRK_AUDIO_ALIGN_TRANSFER, which makes one wonder if
++ * they pretend to be 96kHz mono as a workaround for stereo being broken
++ * by that...
++ *
++ * They also have an issue with initial stream alignment that causes the
++ * channels to be swapped and out of phase, which is dealt with in quirks.c.
++ */
++{
++      .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
++                     USB_DEVICE_ID_MATCH_INT_CLASS |
++                     USB_DEVICE_ID_MATCH_INT_SUBCLASS,
++      .idVendor = 0x534d,
++      .idProduct = 0x0021,
++      .bInterfaceClass = USB_CLASS_AUDIO,
++      .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
++      .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
++              .vendor_name = "MacroSilicon",
++              .product_name = "MS210x",
++              .ifnum = QUIRK_ANY_INTERFACE,
++              .type = QUIRK_COMPOSITE,
++              .data = &(const struct snd_usb_audio_quirk[]) {
++                      {
++                              .ifnum = 2,
++                              .type = QUIRK_AUDIO_ALIGN_TRANSFER,
++                      },
++                      {
++                              .ifnum = 2,
++                              .type = QUIRK_AUDIO_STANDARD_MIXER,
++                      },
++                      {
++                              .ifnum = 3,
++                              .type = QUIRK_AUDIO_FIXED_ENDPOINT,
++                              .data = &(const struct audioformat) {
++                                      .formats = SNDRV_PCM_FMTBIT_S16_LE,
++                                      .channels = 2,
++                                      .iface = 3,
++                                      .altsetting = 1,
++                                      .altset_idx = 1,
++                                      .attributes = 0,
++                                      .endpoint = 0x82,
++                                      .ep_attr = USB_ENDPOINT_XFER_ISOC |
++                                              USB_ENDPOINT_SYNC_ASYNC,
++                                      .rates = SNDRV_PCM_RATE_CONTINUOUS,
++                                      .rate_min = 48000,
++                                      .rate_max = 48000,
++                              }
++                      },
++                      {
++                              .ifnum = -1
++                      }
++              }
++      }
++},
++
++/*
+  * MacroSilicon MS2109 based HDMI capture cards
+  *
+  * These claim 96kHz 1ch in the descriptors, but are actually 48kHz 2ch.
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1129,6 +1129,7 @@ void snd_usb_set_format_quirk(struct snd
+       case USB_ID(0x041e, 0x3f19): /* E-Mu 0204 USB */
+               set_format_emu_quirk(subs, fmt);
+               break;
++      case USB_ID(0x534d, 0x0021): /* MacroSilicon MS2100/MS2106 */
+       case USB_ID(0x534d, 0x2109): /* MacroSilicon MS2109 */
+               subs->stream_offset_adj = 2;
+               break;
diff --git a/queue-4.9/ext4-fix-warning-in-ext4_da_release_space.patch b/queue-4.9/ext4-fix-warning-in-ext4_da_release_space.patch
new file mode 100644 (file)
index 0000000..434126b
--- /dev/null
@@ -0,0 +1,102 @@
+From 1b8f787ef547230a3249bcf897221ef0cc78481b Mon Sep 17 00:00:00 2001
+From: Ye Bin <yebin10@huawei.com>
+Date: Tue, 18 Oct 2022 10:27:01 +0800
+Subject: ext4: fix warning in 'ext4_da_release_space'
+
+From: Ye Bin <yebin10@huawei.com>
+
+commit 1b8f787ef547230a3249bcf897221ef0cc78481b upstream.
+
+Syzkaller report issue as follows:
+EXT4-fs (loop0): Free/Dirty block details
+EXT4-fs (loop0): free_blocks=0
+EXT4-fs (loop0): dirty_blocks=0
+EXT4-fs (loop0): Block reservation details
+EXT4-fs (loop0): i_reserved_data_blocks=0
+EXT4-fs warning (device loop0): ext4_da_release_space:1527: ext4_da_release_space: ino 18, to_free 1 with only 0 reserved data blocks
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 92 at fs/ext4/inode.c:1528 ext4_da_release_space+0x25e/0x370 fs/ext4/inode.c:1524
+Modules linked in:
+CPU: 0 PID: 92 Comm: kworker/u4:4 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
+Workqueue: writeback wb_workfn (flush-7:0)
+RIP: 0010:ext4_da_release_space+0x25e/0x370 fs/ext4/inode.c:1528
+RSP: 0018:ffffc900015f6c90 EFLAGS: 00010296
+RAX: 42215896cd52ea00 RBX: 0000000000000000 RCX: 42215896cd52ea00
+RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000
+RBP: 1ffff1100e907d96 R08: ffffffff816aa79d R09: fffff520002bece5
+R10: fffff520002bece5 R11: 1ffff920002bece4 R12: ffff888021fd2000
+R13: ffff88807483ecb0 R14: 0000000000000001 R15: ffff88807483e740
+FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00005555569ba628 CR3: 000000000c88e000 CR4: 00000000003506f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ ext4_es_remove_extent+0x1ab/0x260 fs/ext4/extents_status.c:1461
+ mpage_release_unused_pages+0x24d/0xef0 fs/ext4/inode.c:1589
+ ext4_writepages+0x12eb/0x3be0 fs/ext4/inode.c:2852
+ do_writepages+0x3c3/0x680 mm/page-writeback.c:2469
+ __writeback_single_inode+0xd1/0x670 fs/fs-writeback.c:1587
+ writeback_sb_inodes+0xb3b/0x18f0 fs/fs-writeback.c:1870
+ wb_writeback+0x41f/0x7b0 fs/fs-writeback.c:2044
+ wb_do_writeback fs/fs-writeback.c:2187 [inline]
+ wb_workfn+0x3cb/0xef0 fs/fs-writeback.c:2227
+ process_one_work+0x877/0xdb0 kernel/workqueue.c:2289
+ worker_thread+0xb14/0x1330 kernel/workqueue.c:2436
+ kthread+0x266/0x300 kernel/kthread.c:376
+ ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
+ </TASK>
+
+Above issue may happens as follows:
+ext4_da_write_begin
+  ext4_create_inline_data
+    ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);
+    ext4_set_inode_flag(inode, EXT4_INODE_INLINE_DATA);
+__ext4_ioctl
+  ext4_ext_migrate -> will lead to eh->eh_entries not zero, and set extent flag
+ext4_da_write_begin
+  ext4_da_convert_inline_data_to_extent
+    ext4_da_write_inline_data_begin
+      ext4_da_map_blocks
+        ext4_insert_delayed_block
+         if (!ext4_es_scan_clu(inode, &ext4_es_is_delonly, lblk))
+           if (!ext4_es_scan_clu(inode, &ext4_es_is_mapped, lblk))
+             ext4_clu_mapped(inode, EXT4_B2C(sbi, lblk)); -> will return 1
+              allocated = true;
+          ext4_es_insert_delayed_block(inode, lblk, allocated);
+ext4_writepages
+  mpage_map_and_submit_extent(handle, &mpd, &give_up_on_write); -> return -ENOSPC
+  mpage_release_unused_pages(&mpd, give_up_on_write); -> give_up_on_write == 1
+    ext4_es_remove_extent
+      ext4_da_release_space(inode, reserved);
+        if (unlikely(to_free > ei->i_reserved_data_blocks))
+         -> to_free == 1  but ei->i_reserved_data_blocks == 0
+         -> then trigger warning as above
+
+To solve above issue, forbid inode do migrate which has inline data.
+
+Cc: stable@kernel.org
+Reported-by: syzbot+c740bb18df70ad00952e@syzkaller.appspotmail.com
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20221018022701.683489-1-yebin10@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/migrate.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/ext4/migrate.c
++++ b/fs/ext4/migrate.c
+@@ -450,7 +450,8 @@ int ext4_ext_migrate(struct inode *inode
+        * already is extent-based, error out.
+        */
+       if (!ext4_has_feature_extents(inode->i_sb) ||
+-          (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
++          ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS) ||
++          ext4_has_inline_data(inode))
+               return -EINVAL;
+       if (S_ISLNK(inode->i_mode) && inode->i_blocks == 0)
diff --git a/queue-4.9/kvm-x86-emulator-em_sysexit-should-update-ctxt-mode.patch b/queue-4.9/kvm-x86-emulator-em_sysexit-should-update-ctxt-mode.patch
new file mode 100644 (file)
index 0000000..4235d84
--- /dev/null
@@ -0,0 +1,36 @@
+From 5015bb89b58225f97df6ac44383e7e8c8662c8c9 Mon Sep 17 00:00:00 2001
+From: Maxim Levitsky <mlevitsk@redhat.com>
+Date: Tue, 25 Oct 2022 15:47:28 +0300
+Subject: KVM: x86: emulator: em_sysexit should update ctxt->mode
+
+From: Maxim Levitsky <mlevitsk@redhat.com>
+
+commit 5015bb89b58225f97df6ac44383e7e8c8662c8c9 upstream.
+
+SYSEXIT is one of the instructions that can change the
+processor mode, thus ctxt->mode should be updated after it.
+
+Note that this is likely a benign bug, because the only problematic
+mode change is from 32 bit to 64 bit which can lead to truncation of RIP,
+and it is not possible to do with sysexit,
+since sysexit running in 32 bit mode will be limited to 32 bit version.
+
+Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
+Message-Id: <20221025124741.228045-11-mlevitsk@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/emulate.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -2881,6 +2881,7 @@ static int em_sysexit(struct x86_emulate
+       ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);
+       ctxt->_eip = rdx;
++      ctxt->mode = usermode;
+       *reg_write(ctxt, VCPU_REGS_RSP) = rcx;
+       return X86EMUL_CONTINUE;
diff --git a/queue-4.9/kvm-x86-emulator-introduce-emulator_recalc_and_set_mode.patch b/queue-4.9/kvm-x86-emulator-introduce-emulator_recalc_and_set_mode.patch
new file mode 100644 (file)
index 0000000..6d6e355
--- /dev/null
@@ -0,0 +1,163 @@
+From d087e0f79fa0dd336a9a6b2f79ec23120f5eff73 Mon Sep 17 00:00:00 2001
+From: Maxim Levitsky <mlevitsk@redhat.com>
+Date: Tue, 25 Oct 2022 15:47:29 +0300
+Subject: KVM: x86: emulator: introduce emulator_recalc_and_set_mode
+
+From: Maxim Levitsky <mlevitsk@redhat.com>
+
+commit d087e0f79fa0dd336a9a6b2f79ec23120f5eff73 upstream.
+
+Some instructions update the cpu execution mode, which needs to update the
+emulation mode.
+
+Extract this code, and make assign_eip_far use it.
+
+assign_eip_far now reads CS, instead of getting it via a parameter,
+which is ok, because callers always assign CS to the same value
+before calling this function.
+
+No functional change is intended.
+
+Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
+Message-Id: <20221025124741.228045-12-mlevitsk@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/emulate.c |   85 ++++++++++++++++++++++++++++++++-----------------
+ 1 file changed, 57 insertions(+), 28 deletions(-)
+
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -750,8 +750,7 @@ static int linearize(struct x86_emulate_
+                          ctxt->mode, linear);
+ }
+-static inline int assign_eip(struct x86_emulate_ctxt *ctxt, ulong dst,
+-                           enum x86emul_mode mode)
++static inline int assign_eip(struct x86_emulate_ctxt *ctxt, ulong dst)
+ {
+       ulong linear;
+       int rc;
+@@ -761,41 +760,71 @@ static inline int assign_eip(struct x86_
+       if (ctxt->op_bytes != sizeof(unsigned long))
+               addr.ea = dst & ((1UL << (ctxt->op_bytes << 3)) - 1);
+-      rc = __linearize(ctxt, addr, &max_size, 1, false, true, mode, &linear);
++      rc = __linearize(ctxt, addr, &max_size, 1, false, true, ctxt->mode, &linear);
+       if (rc == X86EMUL_CONTINUE)
+               ctxt->_eip = addr.ea;
+       return rc;
+ }
++static inline int emulator_recalc_and_set_mode(struct x86_emulate_ctxt *ctxt)
++{
++      u64 efer;
++      struct desc_struct cs;
++      u16 selector;
++      u32 base3;
++
++      ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
++
++      if (!(ctxt->ops->get_cr(ctxt, 0) & X86_CR0_PE)) {
++              /* Real mode. cpu must not have long mode active */
++              if (efer & EFER_LMA)
++                      return X86EMUL_UNHANDLEABLE;
++              ctxt->mode = X86EMUL_MODE_REAL;
++              return X86EMUL_CONTINUE;
++      }
++
++      if (ctxt->eflags & X86_EFLAGS_VM) {
++              /* Protected/VM86 mode. cpu must not have long mode active */
++              if (efer & EFER_LMA)
++                      return X86EMUL_UNHANDLEABLE;
++              ctxt->mode = X86EMUL_MODE_VM86;
++              return X86EMUL_CONTINUE;
++      }
++
++      if (!ctxt->ops->get_segment(ctxt, &selector, &cs, &base3, VCPU_SREG_CS))
++              return X86EMUL_UNHANDLEABLE;
++
++      if (efer & EFER_LMA) {
++              if (cs.l) {
++                      /* Proper long mode */
++                      ctxt->mode = X86EMUL_MODE_PROT64;
++              } else if (cs.d) {
++                      /* 32 bit compatibility mode*/
++                      ctxt->mode = X86EMUL_MODE_PROT32;
++              } else {
++                      ctxt->mode = X86EMUL_MODE_PROT16;
++              }
++      } else {
++              /* Legacy 32 bit / 16 bit mode */
++              ctxt->mode = cs.d ? X86EMUL_MODE_PROT32 : X86EMUL_MODE_PROT16;
++      }
++
++      return X86EMUL_CONTINUE;
++}
++
+ static inline int assign_eip_near(struct x86_emulate_ctxt *ctxt, ulong dst)
+ {
+-      return assign_eip(ctxt, dst, ctxt->mode);
++      return assign_eip(ctxt, dst);
+ }
+-static int assign_eip_far(struct x86_emulate_ctxt *ctxt, ulong dst,
+-                        const struct desc_struct *cs_desc)
++static int assign_eip_far(struct x86_emulate_ctxt *ctxt, ulong dst)
+ {
+-      enum x86emul_mode mode = ctxt->mode;
+-      int rc;
++      int rc = emulator_recalc_and_set_mode(ctxt);
+-#ifdef CONFIG_X86_64
+-      if (ctxt->mode >= X86EMUL_MODE_PROT16) {
+-              if (cs_desc->l) {
+-                      u64 efer = 0;
++      if (rc != X86EMUL_CONTINUE)
++              return rc;
+-                      ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
+-                      if (efer & EFER_LMA)
+-                              mode = X86EMUL_MODE_PROT64;
+-              } else
+-                      mode = X86EMUL_MODE_PROT32; /* temporary value */
+-      }
+-#endif
+-      if (mode == X86EMUL_MODE_PROT16 || mode == X86EMUL_MODE_PROT32)
+-              mode = cs_desc->d ? X86EMUL_MODE_PROT32 : X86EMUL_MODE_PROT16;
+-      rc = assign_eip(ctxt, dst, mode);
+-      if (rc == X86EMUL_CONTINUE)
+-              ctxt->mode = mode;
+-      return rc;
++      return assign_eip(ctxt, dst);
+ }
+ static inline int jmp_rel(struct x86_emulate_ctxt *ctxt, int rel)
+@@ -2197,7 +2226,7 @@ static int em_jmp_far(struct x86_emulate
+       if (rc != X86EMUL_CONTINUE)
+               return rc;
+-      rc = assign_eip_far(ctxt, ctxt->src.val, &new_desc);
++      rc = assign_eip_far(ctxt, ctxt->src.val);
+       /* Error handling is not implemented. */
+       if (rc != X86EMUL_CONTINUE)
+               return X86EMUL_UNHANDLEABLE;
+@@ -2278,7 +2307,7 @@ static int em_ret_far(struct x86_emulate
+                                      &new_desc);
+       if (rc != X86EMUL_CONTINUE)
+               return rc;
+-      rc = assign_eip_far(ctxt, eip, &new_desc);
++      rc = assign_eip_far(ctxt, eip);
+       /* Error handling is not implemented. */
+       if (rc != X86EMUL_CONTINUE)
+               return X86EMUL_UNHANDLEABLE;
+@@ -3467,7 +3496,7 @@ static int em_call_far(struct x86_emulat
+       if (rc != X86EMUL_CONTINUE)
+               return rc;
+-      rc = assign_eip_far(ctxt, ctxt->src.val, &new_desc);
++      rc = assign_eip_far(ctxt, ctxt->src.val);
+       if (rc != X86EMUL_CONTINUE)
+               goto fail;
diff --git a/queue-4.9/kvm-x86-emulator-update-the-emulation-mode-after-cr0-write.patch b/queue-4.9/kvm-x86-emulator-update-the-emulation-mode-after-cr0-write.patch
new file mode 100644 (file)
index 0000000..8c76030
--- /dev/null
@@ -0,0 +1,55 @@
+From ad8f9e69942c7db90758d9d774157e53bce94840 Mon Sep 17 00:00:00 2001
+From: Maxim Levitsky <mlevitsk@redhat.com>
+Date: Tue, 25 Oct 2022 15:47:31 +0300
+Subject: KVM: x86: emulator: update the emulation mode after CR0 write
+
+From: Maxim Levitsky <mlevitsk@redhat.com>
+
+commit ad8f9e69942c7db90758d9d774157e53bce94840 upstream.
+
+Update the emulation mode when handling writes to CR0, because
+toggling CR0.PE switches between Real and Protected Mode, and toggling
+CR0.PG when EFER.LME=1 switches between Long and Protected Mode.
+
+This is likely a benign bug because there is no writeback of state,
+other than the RIP increment, and when toggling CR0.PE, the CPU has
+to execute code from a very low memory address.
+
+Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
+Message-Id: <20221025124741.228045-14-mlevitsk@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/emulate.c |   16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -3643,11 +3643,25 @@ static int em_movbe(struct x86_emulate_c
+ static int em_cr_write(struct x86_emulate_ctxt *ctxt)
+ {
+-      if (ctxt->ops->set_cr(ctxt, ctxt->modrm_reg, ctxt->src.val))
++      int cr_num = ctxt->modrm_reg;
++      int r;
++
++      if (ctxt->ops->set_cr(ctxt, cr_num, ctxt->src.val))
+               return emulate_gp(ctxt, 0);
+       /* Disable writeback. */
+       ctxt->dst.type = OP_NONE;
++
++      if (cr_num == 0) {
++              /*
++               * CR0 write might have updated CR0.PE and/or CR0.PG
++               * which can affect the cpu's execution mode.
++               */
++              r = emulator_recalc_and_set_mode(ctxt);
++              if (r != X86EMUL_CONTINUE)
++                      return r;
++      }
++
+       return X86EMUL_CONTINUE;
+ }
diff --git a/queue-4.9/kvm-x86-mask-off-reserved-bits-in-cpuid.80000008h.patch b/queue-4.9/kvm-x86-mask-off-reserved-bits-in-cpuid.80000008h.patch
new file mode 100644 (file)
index 0000000..dfed9b7
--- /dev/null
@@ -0,0 +1,38 @@
+From 7030d8530e533844e2f4b0e7476498afcd324634 Mon Sep 17 00:00:00 2001
+From: Jim Mattson <jmattson@google.com>
+Date: Thu, 29 Sep 2022 15:52:00 -0700
+Subject: KVM: x86: Mask off reserved bits in CPUID.80000008H
+
+From: Jim Mattson <jmattson@google.com>
+
+commit 7030d8530e533844e2f4b0e7476498afcd324634 upstream.
+
+KVM_GET_SUPPORTED_CPUID should only enumerate features that KVM
+actually supports. The following ranges of CPUID.80000008H are reserved
+and should be masked off:
+    ECX[31:18]
+    ECX[11:8]
+
+In addition, the PerfTscSize field at ECX[17:16] should also be zero
+because KVM does not set the PERFTSC bit at CPUID.80000001H.ECX[27].
+
+Fixes: 24c82e576b78 ("KVM: Sanitize cpuid")
+Signed-off-by: Jim Mattson <jmattson@google.com>
+Message-Id: <20220929225203.2234702-3-jmattson@google.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/cpuid.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/kvm/cpuid.c
++++ b/arch/x86/kvm/cpuid.c
+@@ -647,6 +647,7 @@ static inline int __do_cpuid_ent(struct
+                       g_phys_as = phys_as;
+               entry->eax = g_phys_as | (virt_as << 8);
++              entry->ecx &= ~(GENMASK(31, 16) | GENMASK(11, 8));
+               entry->edx = 0;
+               /*
+                * IBRS, IBPB and VIRT_SSBD aren't necessarily present in
diff --git a/queue-4.9/parisc-export-iosapic_serial_irq-symbol-for-serial-port-driver.patch b/queue-4.9/parisc-export-iosapic_serial_irq-symbol-for-serial-port-driver.patch
new file mode 100644 (file)
index 0000000..031c765
--- /dev/null
@@ -0,0 +1,30 @@
+From a0c9f1f2e53b8eb2ae43987a30e547ba56b4fa18 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Thu, 27 Oct 2022 09:12:05 +0200
+Subject: parisc: Export iosapic_serial_irq() symbol for serial port driver
+
+From: Helge Deller <deller@gmx.de>
+
+commit a0c9f1f2e53b8eb2ae43987a30e547ba56b4fa18 upstream.
+
+The parisc serial port driver needs this symbol when it's compiled
+as module.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Reported-by: kernel test robot <lkp@intel.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/parisc/iosapic.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/parisc/iosapic.c
++++ b/drivers/parisc/iosapic.c
+@@ -889,6 +889,7 @@ int iosapic_serial_irq(struct parisc_dev
+       return vi->txn_irq;
+ }
++EXPORT_SYMBOL(iosapic_serial_irq);
+ #endif
diff --git a/queue-4.9/parisc-make-8250_gsc-driver-dependend-on-config_parisc.patch b/queue-4.9/parisc-make-8250_gsc-driver-dependend-on-config_parisc.patch
new file mode 100644 (file)
index 0000000..1790aac
--- /dev/null
@@ -0,0 +1,36 @@
+From e8a18e3f00f3ee8d07c17ab1ea3ad4df4a3b6fe0 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Fri, 21 Oct 2022 07:44:49 +0200
+Subject: parisc: Make 8250_gsc driver dependend on CONFIG_PARISC
+
+From: Helge Deller <deller@gmx.de>
+
+commit e8a18e3f00f3ee8d07c17ab1ea3ad4df4a3b6fe0 upstream.
+
+Although the name of the driver 8250_gsc.c suggests that it handles
+only serial ports on the GSC bus, it does handle serial ports listed
+in the parisc machine inventory as well, e.g. the serial ports in a
+C8000 PCI-only workstation.
+
+Change the dependency to CONFIG_PARISC, so that the driver gets included
+in the kernel even if CONFIG_GSC isn't set.
+
+Reported-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/8250/Kconfig |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/8250/Kconfig
++++ b/drivers/tty/serial/8250/Kconfig
+@@ -105,7 +105,7 @@ config SERIAL_8250_CONSOLE
+ config SERIAL_8250_GSC
+       tristate
+-      depends on SERIAL_8250 && GSC
++      depends on SERIAL_8250 && PARISC
+       default SERIAL_8250
+ config SERIAL_8250_DMA
index a2ef289a52e437d656f7d5f06d421eed14473458..2d00835938e31a457130318465dae35d707f05d3 100644 (file)
@@ -19,3 +19,11 @@ media-dvb-frontends-drxk-initialize-err-to-0.patch
 i2c-xiic-add-platform-module-alias.patch
 bluetooth-l2cap-fix-attempting-to-access-uninitialized-memory.patch
 btrfs-fix-type-of-parameter-generation-in-btrfs_get_dentry.patch
+alsa-usb-audio-add-quirks-for-macrosilicon-ms2100-ms2106-devices.patch
+parisc-make-8250_gsc-driver-dependend-on-config_parisc.patch
+parisc-export-iosapic_serial_irq-symbol-for-serial-port-driver.patch
+ext4-fix-warning-in-ext4_da_release_space.patch
+kvm-x86-mask-off-reserved-bits-in-cpuid.80000008h.patch
+kvm-x86-emulator-em_sysexit-should-update-ctxt-mode.patch
+kvm-x86-emulator-introduce-emulator_recalc_and_set_mode.patch
+kvm-x86-emulator-update-the-emulation-mode-after-cr0-write.patch